CVE-2026-57202

The record

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected packages

Related vulnerabilities

• CVE-2026-114524 Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows… CWE-267
• CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility… CWE-267
• CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from… CWE-267
• CVE-2026-10090 A flaw was found in the Application Subscription controller… CWE-267
• CVE-2026-6816 An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the… CWE-267